Wealthsimple phish from Microsoft Outlook
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 01 Oct 2026 10:13:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xCJOd-00000000EVO-0ln1
for dave@doctor.nl2k.ab.ca;
Thu, 01 Oct 2026 10:12:35 -0600
Resent-From: The Doctor
Resent-Date: Thu, 1 Oct 2026 10:12:35 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from awi.axureclub.com ([68.210.231.81]:41185)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xCHvs-00000000Lrs-2Psz
for root@nk.ca;
Thu, 01 Oct 2026 08:38:23 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=awi.axureclub.com;
h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:Reply-To;
i=lxwefnixw@awi.axureclub.com;
bh=HATglnR1RhJcBTyhi5/8lr++c0B5Q6PxJCExrNR7LDw=;
b=Si+9sMyr6Vfl+PbDTud4vgq6iLh4x6XxH9ScM0mdrem7OnOUrEkKzkAPx/eIflhlxaUOgjWGz7lC
hGRX63mOQsB4H0ALu10Q13LsrhMcxbE53FezZq7SH7CWqLGEuWU3ANVXDEmTY7Lm55XIzyUV4sjZ
/Bokq6LXALHom6llPWteGhEcdD0m+gUfrYNIcRTPDnmvoj1+NmhfVaUUn2qBGpoPhHPUBqpG78m+
Y+uasnfkdiyZ/Z/hwa0cQLdlX1zuwrpr2C9AMqWwdKMv2FpS7AtIOJHgOS8GIOUKY5fnCoEMHiIw
/xrlp8tsiXj7LWXqrKHXDGo3Wj2hbbAR/cLyJw==
Content-Type: multipart/alternative;
boundary="===============6694005316659739007=="
MIME-Version: 1.0
From: Wealthsimple
To: root@nk.ca
Subject: Update your tax details to avoid withholding tax
Date: Thu, 01 Oct 2026 09:37:21 -0500
Message-ID: <179086544133.6226.10731258806591587462@awi.axureclub.com>
Reply-To: feedback@wealthsimple.com
Feedback-ID: campaign:wealthsimple.com:mailer
X-Spam_score: 28.1
X-Spam_score_int: 281
X-Spam_bar: ++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello root, We noticed that a few tax details on your account
have expired or are missing. If they are not updated, tax may be withheld
from your account at a higher rate. Account: root@nk.ca Reference: 88971955
Details to review: - Tax form (W-8BEN) - Tax residency information
Content analysis details: (28.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[68.210.231.81 listed in will-spam-for-food.eu.org]
[68.210.231.81 listed in will-spam-for-food.eu.org]
[68.210.231.81 listed in will-spam-for-food.eu.org]
[68.210.231.81 listed in will-spam-for-food.eu.org]
[68.210.231.81 listed in will-spam-for-food.eu.org]
[68.210.231.81 listed in will-spam-for-food.eu.org]
[68.210.231.81 listed in will-spam-for-food.eu.org]
[68.210.231.81 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[68.210.231.81 listed in dnsbl.ahbl.org]
[68.210.231.81 listed in dnsbl.ahbl.org]
[68.210.231.81 listed in dnsbl.ahbl.org]
[68.210.231.81 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[68.210.231.81 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[68.210.231.81 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[68.210.231.81 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[68.210.231.81 listed in dnsbl.ahbl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
2.3 MANGLED_ACCNT BODY: mangled account(s)
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[68.210.231.81 listed in bl.score.senderscore.com]
1.5 MR_STRANGE_QUESTION URI: No description available.
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]
1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]
1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]
1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]
1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]
1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]
1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]
1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]
1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]
1.0 J_WEEDS_V FULL: Dec/Hex char Enc [Vv]
1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]
1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]
1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]
1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]
1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]
1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]
1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]
1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]
1.0 J_WEEDS_B FULL: Dec/Hex char Enc [Bb]
2.0 WINDOWS_7BITS Windows charset announced as 7 bit
2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
Subject: {SPAM?} Update your tax details to avoid withholding tax
--===============6694005316659739007==
Content-Type: text/plain; charset=windows-1252
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Hello root,
We noticed that a few tax details on your account have expired or are
missing. If they are not updated, tax may be withheld from your
account at a higher rate.
Account: root@nk.ca
Reference: 88971955
Details to review:
- Tax form (W-8BEN)
- Tax residency information
Update your details:
https://www.wxsmbj.com/?email=root@nk.ca&uid=gW43R73aHEPtNByLaZ1VRB1h
It only takes a minute or two - and it helps us apply the correct tax
rate to your account.
Warm regards,
The Wealthsimple team
---
This email was sent automatically to root@nk.ca.
If this message was not meant for you, you can safely ignore it.
--===============6694005316659739007==
Content-Type: text/html; charset=utf-8
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
|
--===============6694005316659739007==--
